There are three different packages for each TSK release.

  • sleuthkit-X.X.X.tar.gz: This is the source code release of TSK core and framework that you must compile on your computer. This is most commonly used on non-windows systems.
  • This is the compiled windows release of TSK core. This has executables and libraries that allow you to run this on windows.
  • This is the compiled windows release of the framework. It has the tsk_analyzeimg program that allows you to run the framework on a disk image.

For all packages, GPG signatures exist.

The Sleuth Kit can be used with Autopsy, which can be downloaded here. Autopsy 3 (Windows-only) does not require an explicit Sleuth Kit Installation. Autopsy 2 requires that The Sleuth Kit be installed first.

Refer to the SleuthKitWiki for Packages and Add-ons.


See the Support page for details on reporting bugs.


Announcements of new releases are sent to the sleuthkit-announce and sleuthkit-users e-mail lists and the RSS feed .